Extracted

• • Target

    876317053a638df8157c80cf54fd5921_JaffaCakes118

  • Size

    654KB

  • MD5

    876317053a638df8157c80cf54fd5921

  • SHA1

    d1a9c5e2695f323fa882e87bce6bd08c754528c4

  • SHA256

    96190d3f79543dd82de2fba986f3b8c7b4461765cf6a9e254b0e5924fb9bc56f

  • SHA512

    2f9920c46f7a4a0481d4975a65a36f2f02e361ac7888dcb1f99fc55e65c9ac6fa4be5ea03e7e5e3db0f6b0202937314c321cc593e1dfc99d23310166aeaefc46

  • SSDEEP

    12288:vgIdCFdSZHZ5hqZBwE1krLZqFXEMhxcSOlCi7hGHk:IYYSZ550ZBwh9MhRwCSJ

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2